TI-2024-01270 Aliases CVE-2024-1362 GHSA-h67p-q5m6-859h

Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh

LOW 19CWE-352Published 2024-02-23 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cp_shortcode_refresh() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00212 11th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
extendthemes	Colibri Page Builder	up to 1.0.253	—	No fix listed	CNA

Colibri Page Builder Vendorextendthemes Affected up to 1.0.253 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:extendthemes:colibri_page_builder::::::wordpress::*	before 1.0.260	Vulnerable	extendthemes

cpe:2.3:a:extendthemes:colibri_page_builder:*:*:*:*:*:wordpress:*:* Versions before 1.0.260 Vulnerable ·extendthemes

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-1362
2026-10-03 Alias added: GHSA-h67p-q5m6-859h

References

Patch 1

https://plugins.trac.wordpress.org/changeset/3039597/colibri-page-builder/trunk/src/PageBuilder.php

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e7a994-c489-4aea-a9bb-898bc92cae4e?source=cve

TI-2023-02052 Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id CVSS 3.1HIGH 7.2
TI-2025-23283 WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-03122 Cross-site scripting in extendthemes Colibri Page Builder CVSS 3.1MEDIUM 6.4
TI-2023-27738 WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
TI-2023-06389 Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
TI-2024-04679 Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences